File Downloads

Hi,
I’ve watched the video on restricting file downloads, but I’m not sure my case matches any in the video. I have 2 software downloads, each of which is on a yearly license, like so:

Software One
:::: 1-5 seats
:::: 6-10 seats
:::: 11-25 seats
:::: unlimited
Software Two
:::: 1-5 seats
:::: (etc).

I don’t think I want to create a membership level for each option, because there are over 16 options, and because Software One and Software Two are not dependent. One is not a subset of the other, & the tiers of membership shouldn’t have one software download include the other. (I also don’t want to write anything in wp-config.php because I’ll forget to fix it when WordPress updates.)

My thought was I should grant a Key after the user has ordered, maybe by email, using s2member_file_download_key(). But if I sent the key by email, they might not download on the same day & the key would expire. Nor do I want to give a key with no expiration date, because that would bypass the yearly subscription. Perhaps I could create the key after they have logged in to my site, but then that key depends on what they ordered, so … Am I back to adding 16+ membership levels?

How should I approach this?
Thanks.

• This topic was modified 4 years, 5 months ago by  Carla Madni.

Hi Carla.

You may want to use custom capabilities for these. You can sell them independently, without incremental access, and you can protect file downloads with them. Video » s2Member (Custom Capabilities)

In the current s2Member you can’t sell them with a subscription, though, only with one-time payments (Buy Now). Subscriptions work with levels, and for now can only have one per user, not multiple ones.

Does that help?

Hi,
(I’m Carla’s developer, Lore.)
I watched the video which is far more informative than most tutorials I’ve seen. That’s high praise coming from me, because I’ve watched so many.

Based on the video, I think I should create a downloads page, which shows only those items which they’ve purchased using the custom capabilities. Is it possible to combine that purchase with a 1 year subscription at time of sale, thus restricting their access to their downloads page to one year? That would accomplish yearly licensing, and they’d get their reminder email, be able to login for support, etc. If not, would you please consider adding this in the next year, to be able to make a custom capabilities sale, and combine it with a membership?

Also, do you have information about security & whether you’ve proofed this code against injection attacks, etc? I have implemented some solutions myself, such as restricting the admin panel to my IP via htaccess, but I think a page on this topic would be appropriate if it doesn’t exist yet. I wish to cover all the bases that I can. I understand that the card information is not stored on my server, which is a good thing, but is there any danger in having the authorize.net key in there? Could someone do something with that info if they got it, like somehow gain access to my boss’s bank account?

Thanks. :)

Hi Lore,

s2Member is already capable of selling Custom Capabilities alongside a membership. There are two ways this can be done: You can sell the membership first and then once they’re logged in sell individual Custom Capabilities to that member using the Custom Capability Buy Now buttons (see Dashboard -› s2Member® -› PayPal® Pro Forms -› Capability (Buy Now) Forms), or you can simply include the Custom Capabilities with the membership at the time of signup (you’ll simply add the Custom Capabilities to the Pro-Form when you generate it in Dashboard -› s2Member® -› PayPal® Pro Forms -› Membership Level # Forms).

Regarding security: Yes, the s2Member code has been proofed against injection attacks and we’re constantly releasing updates to improve security wherever possible. All of the source code is available for your review. Regarding keys and other security details stored on the server: there is always danger if an attacker gains access to the files on the server. Beyond your Authorize.net key, I’d be more worried about the fact that they’d have access to your WordPress database via the wp-config.php file. There isn’t really anywhere else to store this information, so if you’re worried about server security, I recommend getting in touch with your web host and bringing it up with them. I also recommend checking out the WordPress Security Page.

Perfect,
Thank you for the assistance. I will study everything you recommended.